Comparsion Between AppArmor and Selinux

Question

I was reviewing several different comparison of AppArmor and Selinux which include

• Why I Like AppArmor More Than SELinux
• SELinux and AppArmor: An Introductory Comparison

From these articles I conclude that AppArmor is better than SELinux based on AppArmor is far less complex and far shorter learning curve. Thus majority of comparsion are in favour of AppArmor but how can i say that AppArmor is more secure than Selinux?

Answer 1

These security systems provide tools to isolate applications from each other... and in turn isolate an attacker from the rest of the system when an application is compromised.

SELinux rule sets are incredibly complex but with this complexity you have more control over how processes are isolated. Generating these policies can be automated. A strike against this security system is that its very difficult to independently verify.

AppArmor (and SMACK) is very straight forward. These rule-sets really have to be written by a human, and is just adding another level of file access control (RWX). In Linux everything is a file and this level of control "should be enough". This system is very easy to independently verify.

Answer 2

In general, you cannot say that appArmor is better than SELinux. This is because a lot depends on what it is you are securing and what you are securing against and on the individual skills and preferences of the person/people responsible for maintaining the system.

SELinux has greater fine grained control. In some situations, this would make it more appropriate than AppArmor. On the other hand, AppArmor is likely to be sufficiently powerful for a majority of Linux users. Furthermore, many report that it is easier to understand and use, which means it is less likely that errors in configuration will cause dangerous holes that are difficult to find. On the other hand, making someone who is comfortable and familiar with SELinux use AppArmor could easly result in configuration errors simply because it is not the system they know.

The point is, you need to evaluate based on the specific situation and the skill sets/preferences of those involved. Both are good systems - it is choosing the right tool for the right situation that matters, not which is better than the other.